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Claims 



2 What is claimed, is: 

3 1 . A method of monitoring events in a computer network, the method comprising: 

4 said computer network triggering said events, each event being provided with attribute 

5 values allocated to a given set of attributes, 

6 providing an event display with a cross plot having x and y coordinate axes, the x-axis 

7 presenting a time period and the y-axis presenting an attribute value range, 

8 determining a primary attribute of the events selected from the given set of attributes to 

9 be presented with its attribute values on the y-axis of the cross plot, 
10 

1 1 allocating a first display label to the events indicating the attribute values of the primary 

12 attribute, providing a pattern algorithm to detect whether an arrived event is part of the 

13 given pattern on the basis of a comparison of the attributes allocated to the given pattern 

14 and of the attributes assigned to the arrived event, providing a mapping algorithm to map 

1 5 any attribute value of an attribute selected from the given set of attributes onto the y-axis 

16 of the cross plot, 

17 allocating a second display label to the events indicating the attribute values of the attrib- 

1 8 utes being uncovered as part of the given pattern, plotting all the events arrived within the 

19 time period and including an attribute value allocated to the primary attribute into the 

20 cross plot with the first display label indicating the primary attribute, the position of the 

21 first display label of each event in the cross plot being determined on the basis of the 

22 attribute value of the primary attribute of the event and its arrival time, and 

23 plotting the all events arrived within the time period and being detected by means of the 

24 pattern algorithm as part of the given pattern into the cross plot with the second display 
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1 label indicating the given pattern, the position of the second display label of each event in 

2 the cross plot being determined by the mapping algorithm on the basis of the attribute 

3 value of the attribute of the event being uncovered as part of the given pattern and its 

4 arrival time. 

5 2. The method according to claim 1 , further comprising: 

6 recording the attribute values and the arrival time of a new event, determining on the 

7 basis of the recorded attribute values of event whether or not the newly arrived event 

8 includes an attribute value of the primary attribute, and if the newly arrived event 

9 includes the attribute value for the primary attribute shifting the x-axis of the cross plot so 

10 that the time period being presented on the x-axis covers the arrival time of the event, and 

1 1 plotting the event arrived within the shifted time period into the cross plot with the first 

1 2 display label indicating the primary attribute. 

13 3. The method according to claim 2 comprising the further steps of: 

14 determining on the basis of the recorded attribute values of event whether or not the 

15 newly arrived event is part of the given pattern on the basis of a comparison of the attrib- 

16 utes allocated to the given pattern and of the attributes assigned to the arrived event, 
17 

18 if the newly arrived event includes an attribute value of the given pattern adding the event 

19 to the previous events being detected as part of the given pattern, and 

20 redrawing all the events being associated with given pattern in the cross plot. 

21 4. The method according to claim 3, further comprising: 
22 

23 if the newly arrived event does not include an attribute value of the given pattern, 
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1 determining on the basis of the recorded attribute values of all previous arrived events by 

2 means of the pattern algorithm whether or not the newly arrived event is part of a new 

3 pattern on the basis of a comparison of the attributes allocated to the new pattern and of 

4 the attributes assigned to the arrived events; 

5 if the newly arrived event forms together with previous recorded events the new pattern, 

6 allocating a third display label to the events indicating the attribute values of the attributes 

7 being uncovered as part of the new pattern; and 

8 plotting the all events being detected by means of the pattern algorithm as part of the new 

9 pattern into the cross plot with the third display label indicating the new pattern, the 

10 position of the third display label of each event in the cross plot being determined by the 

1 1 mapping algorithm on the basis of the attribute value of the attribute of the event being 

12 uncovered as part of the new pattern and its arrival time. 

13 5. The method according to claim 1 , further comprising: . 

14 removing all the events including an attribute value allocated to the primary attribute 

15 from the cross plot, if a primary attribute to be presented with its attribute values on the 

16 y-axis of the cross plot is changed, allocating a fourth display label to the events indicat- 

1 7 ing the attribute values of the new primary attribute, and 

1 8 plotting all the events arrived within the time period and including an attribute value 

1 9 allocated to the new primary attribute into the cross plot with the fourth display label 

20 indicating the new primary attribute, the position of the fourth display label of each event 

21 in the cross plot being determined on the basis of the attribute value of the primary attrib- 

22 ute of the event and its arrival time. 

23 6. The method according to claim 1 comprising the further steps of 

24 plotting all attribute values recorded for an event with the respective display label into the 
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1 

2 



cross plot if the event is selected by an operator, and displaying textual information 
associated with the selected event on the event display. 



3 7. The method according to claim 1 , wherein the pattern algorithm is suitable to 

4 perform multi-attribute pattern recognition. 

5 8. The method according to claim 1, wherein each display label includes a specific 

6 color and/or a specific mark layout. 

7 9. The method according to claim 1, wherein all events being uncovered as part of 

8 the pattern are clustered by the corresponding display label. 

9 10. A computer program containing a program code to carry out the steps of the 

1 0 method of claim 1 , when the program code is running on a computer. 

11 11. A computer program containing a program code to carry out the steps of the 

1 2 method of claim 1 , said program code being stored on data carrier. 

13 12. An event visualization device for monitoring events in a computer network, the 

14 device comprising means to perform the steps of the method as claimed in claim 

15 1. 

16 13. An article of manufacture comprising a computer usable medium having computer 

17 readable program code means embodied therein for causing monitoring of events in a 

1 8 computer network, the computer readable program code means in said article of manufac- 

1 9 ture comprising computer readable program code means for causing a computer to effect 

20 the steps of claim 1 . 

21 14. A program storage device readable by machine, tangibly embodying a program of 

22 instructions executable by the machine to perform method steps for monitoring events in 
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1 a computer network, said method steps comprising the steps of claim 1 . 



2 15. A computer program product comprising a computer usable medium having 

3 computer readable program code means embodied therein for causing the event visualiza- 

4 tion device, the computer readable program code means in said computer program 

5 product comprising computer readable program code means for causing a computer to 

6 effect the functions of claim 12. 
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